Privacy Policy

This Privacy Policy explains how Superfood Farm Private Limited collects, uses, stores, shares and protects personal data when you visit or use our website, create an account, place an order, contact us, participate in a promotion or otherwise interact with us. It also explains your choices and rights concerning your personal data.

By using our website or voluntarily providing personal data to us, you acknowledge this Privacy Policy. Where applicable law requires consent, we will request it through a clear affirmative action. Acceptance of this Privacy Policy does not by itself constitute consent for optional marketing, analytics or advertising activities.

1 Who We Are

Superfood Farm Private Limited operates the Superfood Farm online store and determines the purposes and means for which customer personal data is processed. Under applicable Indian data protection law, we act as the data fiduciary for personal data processed for our business purposes. Shopify and other vendors may process personal data on our behalf or, for certain services, for their own stated purposes.

Our contact details and the details of our Privacy and Grievance Officer appear in Section 18.

2 Scope

This Policy applies to personal data collected through our website, Shopify storefront, customer accounts, guest checkout, customer-care channels, email, telephone, SMS, WhatsApp, surveys, reviews, contests, loyalty or referral programmes and other services that link to this Policy.

It does not govern websites, applications or services operated independently by third parties. Those parties process personal data under their own terms and privacy notices.

3 Personal Data We Collect

3.1 Information You Provide

·         Identity and contact information, including your name, email address, telephone number, billing address and delivery address.

·         Account information, including account identifiers, login credentials in protected form, saved addresses, preferences and order history.

·         Order and transaction information, including products purchased, order value, discounts, payment status, transaction reference, invoices, refunds, returns, cancellations and delivery records.

·         Communications, including customer-care requests, complaints, feedback, survey responses, reviews and messages sent by email, telephone, chat, SMS, WhatsApp or social media.

·         Marketing and preference information, including subscriptions, communication choices, consent records, loyalty activity, referrals and promotion entries.

·         Any other information you choose to provide while using our services.

3.2 Information Collected Automatically

·         Device and network information, including IP address, device type, browser, operating system, language, identifiers and approximate location derived from an IP address.

·         Website activity, including pages viewed, search and navigation activity, referring source, links selected, cart activity, checkout events, timestamps and interactions with communications.

·         Cookie, pixel and similar technology data used for essential website functions, analytics, security, advertising and preference management.

·         Technical and security logs used to operate the website, detect errors, prevent fraud and investigate unauthorised activity.

3.3 Information From Other Sources

We may receive personal data from Shopify, Razorpay, banks and payment networks, courier and fulfilment partners, analytics and advertising platforms, customer-support providers, referral partners and social-media platforms. The information received depends on the service used and the permissions or choices you have made with that provider.

3.4 Health and Other Sensitive Information

Our standard online store does not require you to provide health records, medical history, biometric data, passwords for third-party services, complete card credentials or other sensitive information unrelated to a purchase. Please do not include medical or similarly sensitive information in reviews or ordinary customer-care messages. If we introduce a service that genuinely requires such information, we will provide a separate notice and obtain the consent required by law before collecting it.

4 How We Collect Personal Data

We collect personal data:

·         directly from you when you create an account, use guest checkout, place an order, contact us or join a programme;

·         automatically through Shopify, cookies, pixels, log files and similar technologies;

·         from payment, delivery, analytics, advertising, customer-support and fraud-prevention providers; and

·         from publicly available sources or social-media interactions where permitted by law.

5 Why We Process Personal Data

We process personal data only for lawful and specified purposes, including to:

·         create and manage customer accounts and enable guest checkout;

·         confirm, process, deliver, track, cancel, return or refund orders;

·         process payments and communicate transaction status through Razorpay and participating banks or payment networks;

·         send order confirmations, delivery updates, service notices and other transactional communications;

·         respond to questions, complaints, product concerns and warranty or service requests;

·         maintain invoices, accounting records, tax records, transaction evidence and audit trails;

·         detect, prevent and investigate fraud, abuse, security incidents and unlawful activity;

·         operate, test, troubleshoot, secure and improve our website, products and services;

·         measure website usage and campaign performance;

·         personalise website content and advertising where you have provided the required consent;

·         send promotional communications where you have opted in or where otherwise permitted by law;

·         administer reviews, surveys, contests, subscriptions, loyalty and referral programmes;

·         establish, exercise or defend legal claims and comply with applicable law, regulatory directions and lawful requests; and

·         complete a merger, acquisition, restructuring or transfer of business, subject to appropriate safeguards.

6 Consent and Your Choices

Where consent is the basis for processing, we will request consent in clear and plain language and limit the request to personal data necessary for the specified purpose. Consent will be obtained through a clear affirmative action and will not be bundled with unrelated optional purposes.

You may withdraw consent at any time using the unsubscribe link in a marketing email, available account or cookie controls, or by contacting us. Withdrawing consent does not affect processing already carried out lawfully. We may continue processing where it is necessary to complete an existing order, comply with law, maintain required records, prevent fraud or establish or defend legal claims.

Declining optional marketing, analytics or advertising consent will not prevent you from purchasing products. Disabling essential cookies may affect account, cart, checkout, security or other website functions.

7 Customer Accounts and Guest Checkout

You may purchase through a registered account or, where available, through guest checkout. Account information is used to authenticate you, display order history, save preferences and support future purchases. You are responsible for keeping your login details confidential and for informing us if you suspect unauthorised account access.

Closing an account does not automatically erase every related record. We may retain order, invoice, payment, delivery, complaint, fraud-prevention and legal records for the periods described in Section 13.

8 Payments and Razorpay

Payments are processed through Razorpay and the relevant banks, card networks, UPI participants, wallet providers or other payment partners. When you select a payment method, the information required to process and authenticate the transaction is provided to Razorpay and those payment participants.

Superfood Farm does not store complete card numbers, CVV, PIN or other full card credentials in its systems. Razorpay and participating payment providers may collect, process, store, monitor and share payment and transaction information for payment processing, settlement, fraud prevention, dispute handling, chargebacks, audits and regulatory compliance under their own terms and privacy notices.

You can review Razorpay's privacy information at https://razorpay.com/privacy/.

9 Cookies Analytics and Advertising

We and our service providers use cookies, pixels, software development tools and similar technologies. These technologies may collect device identifiers, IP address, browser information, page activity, cart and checkout events, referring source and interaction data.

We use the following categories:

·         Strictly necessary technologies for security, account access, cart, checkout, fraud prevention and core website operation.

·         Preference technologies that remember settings and improve convenience.

·         Analytics technologies, including services such as Google Analytics, that help us understand website and campaign performance.

·         Advertising technologies, including services such as Meta Pixel and Google Ads, that measure advertising, create audiences and display more relevant promotions where permitted.

Where required, optional analytics and advertising technologies will be activated only after you make a choice through our cookie banner or preference centre. You can change those choices later through the cookie settings made available on our website. You may also control cookies through your browser, although browser controls may not block every pixel or similar technology.

10 Marketing Communications

Where you have opted in, we may send product news, offers, cart reminders, surveys and other promotional messages by email, SMS, telephone or WhatsApp. Transactional messages about an order or account are not promotional messages and may continue while needed to provide the requested service.

You may opt out through the unsubscribe or preference option included in the message, by changing available account settings, or by contacting us. We may retain a minimal suppression record so that we can respect your opt-out choice.

11 How We Share Personal Data

We do not sell or rent personal data. We may share it, only as necessary, with:

·         Shopify and its affiliates and subprocessors for ecommerce hosting, storefront, account, checkout, analytics and related services;

·         Razorpay, banks, payment networks and payment participants for processing, authentication, settlement, fraud prevention, refunds and disputes;

·         courier, warehouse, delivery and fulfilment providers for order fulfilment;

·         email, SMS, WhatsApp, customer-support and CRM providers for communications and support;

·         analytics, advertising and social-media platforms, subject to applicable consent choices;

·         technology, cloud, security, fraud-prevention and professional service providers acting under appropriate obligations;

·         auditors, accountants, insurers, legal advisers and potential transaction advisers;

·         government, regulatory, judicial and law-enforcement authorities when disclosure is required or authorised by law; and

·         a buyer, successor or reorganised entity in connection with a merger, acquisition, restructuring, insolvency or transfer of all or part of our business.

Where a provider processes personal data on our behalf, we require an appropriate contract and safeguards consistent with the nature of the processing. Certain providers, including payment participants and some Shopify services, may independently determine aspects of their processing and are responsible for that processing under their own privacy notices.

12 International Processing

Our business is based in India. Shopify operates globally, and Shopify, its affiliates and its service providers may transfer or process customer personal data in other countries, including countries where their infrastructure or personnel are located. Other technology providers may also process data outside India.

Where personal data is transferred outside India, we will take reasonable steps to use providers and contractual arrangements intended to protect the data and will comply with restrictions or conditions imposed under applicable Indian law. The laws of another country may provide different protections from those available in India.

Information about Shopify's processing is available at Shopify Privacy for Customers.

13 Data Retention

We retain personal data only for as long as needed for the specified purpose or as required or authorised by applicable law, contractual obligations, dispute-resolution needs, fraud prevention and legitimate recordkeeping.

·         Order, transaction, invoice, settlement, refund, chargeback and related records are retained for at least ten years from the relevant order, or longer where required by law, legal proceedings or a binding regulatory direction.

·         Account data is retained while the account remains active and afterwards only for purposes that still require it.

·         Customer-care and grievance records are retained for the time needed to resolve the matter, demonstrate the response and manage related claims.

·         Marketing data is retained until you withdraw consent or the purpose ends. A minimal suppression record may be retained after opt-out.

·         Security, access and processing logs are retained for at least the minimum period required by applicable law and may be kept longer for investigation, security or legal compliance.

·         Cookie and advertising data is retained according to the duration shown in the relevant provider settings or cookie preference information.

When retention is no longer justified, we will take reasonable steps to delete, anonymise or securely isolate the personal data and instruct applicable processors to do the same, subject to their lawful retention obligations and backup cycles.

14 Security

We use reasonable technical and organisational safeguards appropriate to the nature of the personal data and the risks involved. These may include encryption in transit, access controls, authentication controls, logging and monitoring, backups, incident-response procedures, restricted staff access, vendor due diligence and contractual security requirements.

No internet transmission or storage system can be guaranteed to be completely secure. You should use a strong, unique password, protect access to your device and promptly notify us if you suspect unauthorised use of your account.

15 Personal Data Breaches

If we become aware of a personal data breach, we will investigate, contain and remediate it and maintain appropriate records. Where required by applicable law, we will notify affected individuals and the competent authority or Data Protection Board without undue delay and provide information about the nature of the breach, its likely consequences, measures taken and steps individuals can take to protect themselves.

16 Children and Persons Requiring Lawful Guardians

Our website and purchasing services are intended for individuals who are 18 years of age or older. We do not knowingly request or collect personal data directly from children. Purchases for a child should be made by a parent or lawful guardian.

If a service requires the processing of personal data of a child or of a person who is legally represented by a lawful guardian, we will obtain verifiable consent and follow the safeguards required by applicable law before processing. We do not knowingly conduct tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child has provided personal data to us without appropriate authorisation, contact us so that we can investigate and take suitable action.

17 Your Rights

Subject to applicable law and verification of your identity, you may request to:

·         obtain a summary of personal data being processed and the processing activities undertaken;

·         obtain information about other entities with whom your personal data has been shared, where required by law;

·         correct inaccurate or misleading personal data;

·         complete incomplete personal data and update outdated personal data;

·         erase personal data that is no longer required, subject to lawful retention;

·         withdraw consent for consent-based processing;

·         opt out of promotional communications and manage cookie choices;

·         raise a grievance concerning our processing or response; and

·         nominate another individual to exercise your rights in the event of your death or incapacity, where this right applies.

To submit a request, email care@superfoodfarm.in with the subject line 'Privacy Request' or 'Privacy Grievance'. Include your name, registered email address or telephone number, relevant order number if applicable and a clear description of the request. We may request proportionate information to verify your identity and protect your account from unauthorised access.

We aim to acknowledge requests promptly and resolve grievances within 30 days after receiving the information reasonably required to process them. Complex or legally restricted requests may take longer, in which case we will communicate the reason and expected next step. If you remain dissatisfied after using our grievance mechanism, you may approach the competent authority or the Data Protection Board of India when the applicable complaint mechanism is in force.

You may request an accessible copy of this Policy or information about available language options by contacting us.

18 Privacy Questions and Grievance Contact

Privacy and Grievance Officer

Superfood Farm Private Limited

Address: CP2 44, Backary Portion, 2nd Floor, Regal Building, Innov8, Outer Circle, Connaught Place, New Delhi - 110001

Email: care@superfoodfarm.in

Toll-free: 1800 889 2606

19 Changes to This Privacy Policy

We may update this Policy to reflect changes in our services, providers, technology or legal obligations. The revised version will be posted with a new 'Last updated' date. Where a change materially affects how we process personal data or requires fresh consent, we will provide an appropriate notice and obtain consent where required before applying the new processing.

20 Business Transfers

If Superfood Farm is involved in a merger, acquisition, restructuring, financing, insolvency or transfer of business or assets, personal data may be disclosed to professional advisers and transferred to the relevant successor or acquiring entity. Any recipient will be required to handle the personal data consistently with applicable law and the commitments communicated to you.